CVE Feed

    Dashboard / CVE / CVE-2026-26274

    CVE-2026-26274

    October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a vulnerability was identified in the Twig sandbox security policy that allowed database write operations when cms.safe_mode is enabled. Backend users with Developer permissions could use Twig template markup to execute insert, update, and delete operations on any database table through the query builder, which is included in the sandbox allow-list. This vulnerability is fixed in 3.7.14 and 4.1.10.

    Published:Apr 21, 2026
    Last Modified:Apr 22, 2026
    EPS:Apr 21, 2026
    EPSS Score:0.00053
    CVSS Score:6.6

    Affected Products

    Vendor
    Octobercms
    Product
    October

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-29179 (CVSS 3.3) — October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, fine-grained sub-pe…
    CVE-2026-27937 (CVSS 3.1) — October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, a reflected Cross-S…
    CVE-2026-26067 (CVSS 4.9) — October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a server-side infor…
    CVE-2026-25133 (CVSS 4.8) — October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a s…
    CVE-2026-25125 (CVSS 4.9) — October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a s…
    CVE-2026-24907 (CVSS 5.1) — October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a s…
    CVE-2026-24906 (CVSS 5.1) — October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a S…
    CVE-2026-22692 (CVSS 4.9) — October is a Content Management System (CMS) and web platform. Versions prior to 3.7.13 and versions 4.0.0 thr…
    CVE-2025-61674 (CVSS 6.1) — October is a Content Management System (CMS) and web platform. Prior to versions 3.7.13 and 4.0.12, a cross-si…
    CVE-2025-61676 (CVSS 6.1) — October is a Content Management System (CMS) and web platform. Prior to versions 3.7.13 and 4.0.12, a cross-si…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High